Off-Chain Message Signing

Off-chain message signing is being asked to sign text rather than send a transaction. Nothing goes to the network, no gas is paid, and nothing appears in the wallet's transaction history, which is why it is used for the harmless case — proving you control an address in order to log in to a site — and why it is dangerous in the harmful one. The signature is a portable proof made with the same key that spends, and whoever holds it can present it wherever it is accepted. Some standards make that binding explicit, tying the message to one contract and one chain and displaying its fields; others hand the wallet an opaque string it can only show as data. The practical rules are the same either way. A login request should name the site and say what it is for, should not be a block of unreadable characters, and should never be signed on a page reached from a message or an advertisement. If you cannot state what accepting a prompt authorises, that is the reason to refuse it.